Kimi cli: Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type (CVE-2026-41479)

The vulnerability in Authlib's OAuth 2.0 authorization endpoint arises from the handling of unsupported response_type values. When such a response_type is received, the server raises an UnsupportedResponseTypeError that includes the raw redirect_uri from the request without validating the client or the redirect URI. The error handling mechanism then issues a 302 redirect to this attacker-controlled URI, effectively creating an unauthenticated open redirect. This behavior is reachable through normal OAuth2 authorization flows in Flask and Django integrations using Authlib. The issue was confirmed in tag v1.6.6 and later commits, and a proof-of-concept demonstrates the redirect to arbitrary URLs without client registration or user authentication.

An attacker can exploit this vulnerability to perform an open redirect attack by supplying a malicious redirect_uri with an unsupported response_type parameter. This can lead to phishing or other social engineering attacks by redirecting users to attacker-controlled sites. The vulnerability does not require a valid client, authenticated user, or prior state, making exploitation straightforward. However, it does not directly allow token theft or privilege escalation. The CVSS 3.1 score is 5.4, indicating medium severity with low complexity and no privileges required.

A patch is available for this vulnerability. Users should upgrade to fixed versions of kimi-cli that address this issue. Until patched, avoid using unsupported response_type values and validate redirect_uri parameters strictly. The vendor advisory confirms the availability of a fix; therefore, applying the official patch is the recommended remediation.